ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/CBOR-XS/XS.pm
(Generate patch)

Comparing CBOR-XS/XS.pm (file contents):
Revision 1.68 by root, Wed Jul 17 09:37:16 2019 UTC vs.
Revision 1.69 by root, Sat Nov 9 07:23:31 2019 UTC

… …
215(L<http://cbor.schmorp.de/value-sharing>), as without decoder support, the 215(L<http://cbor.schmorp.de/value-sharing>), as without decoder support, the
216resulting data structure might be unusable. 216resulting data structure might be unusable.
217 217
218Detecting shared values incurs a runtime overhead when values are encoded 218Detecting shared values incurs a runtime overhead when values are encoded
219that have a reference counter large than one, and might unnecessarily 219that have a reference counter large than one, and might unnecessarily
220increase the encoded size, as potentially shared values are encode as 220increase the encoded size, as potentially shared values are encoded as
221shareable whether or not they are actually shared. 221shareable whether or not they are actually shared.
222 222
223At the moment, only targets of references can be shared (e.g. scalars, 223At the moment, only targets of references can be shared (e.g. scalars,
224arrays or hashes pointed to by a reference). Weirder constructs, such as 224arrays or hashes pointed to by a reference). Weirder constructs, such as
225an array with multiple "copies" of the I<same> string, which are hard but 225an array with multiple "copies" of the I<same> string, which are hard but
… …
1057 1057
1058 1058
1059=head1 SECURITY CONSIDERATIONS 1059=head1 SECURITY CONSIDERATIONS
1060 1060
1061Tl;dr... if you want to decode or encode CBOR from untrusted sources, you 1061Tl;dr... if you want to decode or encode CBOR from untrusted sources, you
1062should start with a coder object created via C<new_safe>: 1062should start with a coder object created via C<new_safe> (which implements
1063the mitigations explained below):
1063 1064
1064 my $coder = CBOR::XS->new_safe; 1065 my $coder = CBOR::XS->new_safe;
1065 1066
1066 my $data = $coder->decode ($cbor_text); 1067 my $data = $coder->decode ($cbor_text);
1067 my $cbor = $coder->encode ($data); 1068 my $cbor = $coder->encode ($data);
… …
1089even if all your C<THAW> methods are secure, encoding data structures from 1090even if all your C<THAW> methods are secure, encoding data structures from
1090untrusted sources can invoke those and trigger bugs in those. 1091untrusted sources can invoke those and trigger bugs in those.
1091 1092
1092So, if you are not sure about the security of all the modules you 1093So, if you are not sure about the security of all the modules you
1093have loaded (you shouldn't), you should disable this part using 1094have loaded (you shouldn't), you should disable this part using
1094C<forbid_objects>. 1095C<forbid_objects> or using C<new_safe>.
1095 1096
1096=item CBOR can be extended with tags that call library code 1097=item CBOR can be extended with tags that call library code
1097 1098
1098CBOR can be extended with tags, and C<CBOR::XS> has a registry of 1099CBOR can be extended with tags, and C<CBOR::XS> has a registry of
1099conversion functions for many existing tags that can be extended via 1100conversion functions for many existing tags that can be extended via
1100third-party modules (see the C<filter> method). 1101third-party modules (see the C<filter> method).
1101 1102
1102If you don't trust these, you should configure the "safe" filter function, 1103If you don't trust these, you should configure the "safe" filter function,
1103C<CBOR::XS::safe_filter>, which by default only includes conversion 1104C<CBOR::XS::safe_filter> (C<new_safe> does this), which by default only
1104functions that are considered "safe" by the author (but again, they can be 1105includes conversion functions that are considered "safe" by the author
1105extended by third party modules). 1106(but again, they can be extended by third party modules).
1106 1107
1107Depending on your level of paranoia, you can use the "safe" filter: 1108Depending on your level of paranoia, you can use the "safe" filter:
1108 1109
1109 $cbor->filter (\&CBOR::XS::safe_filter); 1110 $cbor->filter (\&CBOR::XS::safe_filter);
1110 1111
… …
1125the size of CBOR data you accept, or make sure then when your resources 1126the size of CBOR data you accept, or make sure then when your resources
1126run out, that's just fine (e.g. by using a separate process that can 1127run out, that's just fine (e.g. by using a separate process that can
1127crash safely). The size of a CBOR string in octets is usually a good 1128crash safely). The size of a CBOR string in octets is usually a good
1128indication of the size of the resources required to decode it into a Perl 1129indication of the size of the resources required to decode it into a Perl
1129structure. While CBOR::XS can check the size of the CBOR text (using 1130structure. While CBOR::XS can check the size of the CBOR text (using
1130C<max_size>), it might be too late when you already have it in memory, so 1131C<max_size> - done by C<new_safe>), it might be too late when you already
1131you might want to check the size before you accept the string. 1132have it in memory, so you might want to check the size before you accept
1133the string.
1132 1134
1133As for encoding, it is possible to construct data structures that are 1135As for encoding, it is possible to construct data structures that are
1134relatively small but result in large CBOR texts (for example by having an 1136relatively small but result in large CBOR texts (for example by having an
1135array full of references to the same big data structure, which will all be 1137array full of references to the same big data structure, which will all be
1136deep-cloned during encoding by default). This is rarely an actual issue 1138deep-cloned during encoding by default). This is rarely an actual issue
… …
1149method. 1151method.
1150 1152
1151=item Resource-starving attacks: CPU en-/decoding complexity 1153=item Resource-starving attacks: CPU en-/decoding complexity
1152 1154
1153CBOR::XS will use the L<Math::BigInt>, L<Math::BigFloat> and 1155CBOR::XS will use the L<Math::BigInt>, L<Math::BigFloat> and
1154L<Math::BigRat> libraries to represent encode/decode bignums. These can 1156L<Math::BigRat> libraries to represent encode/decode bignums. These can be
1155be very slow (as in, centuries of CPU time) and can even crash your 1157very slow (as in, centuries of CPU time) and can even crash your program
1156program (and are generally not very trustworthy). See the next section for 1158(and are generally not very trustworthy). See the next section on bignum
1157details. 1159security for details.
1158 1160
1159=item Data breaches: leaking information in error messages 1161=item Data breaches: leaking information in error messages
1160 1162
1161CBOR::XS might leak contents of your Perl data structures in its error 1163CBOR::XS might leak contents of your Perl data structures in its error
1162messages, so when you serialise sensitive information you might want to 1164messages, so when you serialise sensitive information you might want to

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines